CODEWITHSUNDEEP
c#.netwindowsregistry64-bit
Bobby Tables
Bobby Tables

Reputation: 3013

Searching x32 registry keys from a x64 program

I'm writing a C# application that is for x64 and my problem is that i'm searching the registry for some keys that contain certain keywords and and i am only able to search the registry of x64 applications because of registry redirection.
I manged to find some code on the net but i don't really know what to do with it because from what i understand it only works if i know the exact key name while i'm searching for patterns or keywords. [DllImport("advapi32.dll", EntryPoint = "RegOpenKeyEx")] public static extern int RegOpenKeyEx_DllImport( UIntPtr hKey, string subKey, uint options, int sam, out IntPtr phkResult);

    [DllImport("advapi32.dll", EntryPoint = "RegQueryValueEx")]
    static extern int RegQueryValueEx_DllImport(
        IntPtr hKey,
        string lpValueName,
        int lpReserved,
        out uint lpType,
        System.Text.StringBuilder lpData,
        ref uint lpcbData);

public string GetKeyValue(string strSubKey, string strKey)
    {

        UIntPtr HKEY_LOCAL_MACHINE = (UIntPtr)0x80000002;
        const int KEY_WOW64_32KEY = 0x0200;
        const int KEY_QUERY_VALUE = 0x1;

        IntPtr hKeyVal;
        uint lpType;
        uint lpcbData = 0;
        System.Text.StringBuilder pvData = new System.Text.StringBuilder(1024);
        int valueRet;



        string returnPath = String.Empty;
        unchecked
        {
            try
            {   //Open the required key path
                valueRet = RegOpenKeyEx_DllImport(HKEY_LOCAL_MACHINE, strSubKey, 0, KEY_QUERY_VALUE | KEY_WOW64_32KEY, out hKeyVal);

                //Retreive the key value
                valueRet = RegQueryValueEx_DllImport(hKeyVal, strKey, 0, out lpType, pvData, ref lpcbData);

                valueRet = RegQueryValueEx_DllImport(hKeyVal, strKey, 0, out lpType, pvData, ref lpcbData);

                returnPath = pvData.ToString();
            }
            catch (Exception e)
            {
                throw (e);
            }
        }
        return returnPath;
    }

Upvotes: 0

Views: 1626

Answers (2)

tyranid
tyranid

Reputation: 13318

If you are targeting .net 4 there is a new addition to allow you to specify the 32bit registry in managed code. You use OpenBaseKey specifying the appropriate RegistryView.

Upvotes: 2

Mike Gwilt
Mike Gwilt

Reputation: 2449

Have you tried using LogParser? Here's an example of how to use it to query the registry.

https://stackoverflow.com/a/295265/977292

Upvotes: 0

Related Questions